Skip to content
OpenAdvisories

Archive

August 2023

Vulnerabilities first published in this month (UTC), newest first.

← July 2023 2023 / August September 2023 →
  1. 184
  2. 256
  3. 3150
  4. 457
  5. 526
  6. 619
  7. 7115
  8. 8254
  9. 9102
  10. 10133
  11. 11155
  12. 123
  13. 1329
  14. 14136
  15. 1595
  16. 16104
  17. 1779
  18. 1859
  19. 197
  20. 2014
  21. 2163
  22. 22191
  23. 2361
  24. 2465
  25. 2586
  26. 266
  27. 2713
  28. 2877
  29. 2952
  30. 30119
  31. 31104
All Critical High Medium Low Exploited only Public exploit

2,514 results · Feed

  • High 7.1
    CVE-2023-34175

    WordPress Login Configurator Plugin <= 2.1 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in GrandSlambert Login Configurator plugin <= 2.1 versions.

    GrandSlambert Login Configurator
  • High 7.1
    CVE-2023-34176

    WordPress Chilexpress woo oficial Plugin <= 1.2.9 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Chilexpress Chilexpress woo oficial plugin <= 1.2.9 versions.

    Chilexpress Chilexpress woo oficial
  • High 7.1
    CVE-2023-34184

    WordPress Woocommerce Order address Print Plugin <= 3.2 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Bhavik Patel Woocommerce Order address Print plugin <= 3.2 versions.

    Bhavik Patel Woocommerce Order address Print Web / CMS
  • Medium 5.9
    CVE-2023-34183

    WordPress Unite Gallery Lite Plugin <= 1.7.61 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Valiano Unite Gallery Lite plugin <= 1.7.61 versions.

    Valiano Unite Gallery Lite
  • Medium 5.9
    CVE-2023-34187

    WordPress Call Now Icon Animate Plugin <= 0.1.0 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Alan Tien Call Now Icon Animate plugin <= 0.1.0 versions.

    Alan Tien Call Now Icon Animate
  • Medium 5.9
    CVE-2023-27426

    WordPress NotifyVisitors Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Notifyvisitors NotifyVisitors plugin <= 1.0 versions.

    Notifyvisitors NotifyVisitors
  • Medium 5.9
    CVE-2023-33929

    WordPress Easy Admin Menu Plugin <= 1.3 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Joaquín Ruiz Easy Admin Menu plugin <= 1.3 versions.

    Joaquín Ruiz Easy Admin Menu
  • High 7.1
    CVE-2023-33320

    WordPress WP-Hijri Plugin <= 1.5.1 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Mohammad I. Okfie WP-Hijri plugin <= 1.5.1 versions.

    Mohammad I. Okfie WP-Hijri
  • High 7.1
    CVE-2023-33325

    WordPress Leyka Plugin <= 3.30.1 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Teplitsa of social technologies Leyka plugin <= 3.30.1 versions.

    Teplitsa of social technologies Leyka
  • High 7.1
    CVE-2023-33317

    WordPress WooCommerce Warranty Requests Plugin <= 2.1.6 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce Returns and Warranty Requests plugin <= 2.1.6 versions.

    woocommerce Returns and Warranty Requests
  • Medium 5.9
    CVE-2023-33210

    WordPress nuajik CDN Plugin <= 0.1.0 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in nuajik plugin <= 0.1.0 versions.

    nuajik nuajik
  • Medium 5.9
    CVE-2023-25462

    WordPress WP htaccess Control Plugin <= 3.5.1 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WP htaccess Control plugin <= 3.5.1 versions.

  • Medium 5.9
    CVE-2023-33208

    WordPress Cookie Monster Plugin <= 1.51 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in gsmith Cookie Monster plugin <= 1.51 versions.

    gsmith Cookie Monster
  • Low 2.4
    CVE-2023-4624

    Server-Side Request Forgery (SSRF) in bookstackapp/bookstack

    Server-Side Request Forgery (SSRF) in GitHub repository bookstackapp/bookstack prior to v23.08.

    BookStackApp bookstackapp/bookstack
  • Medium 5.9
    CVE-2023-32962

    WordPress WishSuite Plugin <= 1.3.4 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in HasTheme WishSuite – Wishlist for WooCommerce plugin <= 1.3.4 versions.

    HasTheme WishSuite – Wishlist for WooCommerce Web / CMS
  • High 7.1
    CVE-2023-25019

    WordPress Chaty Plugin <= 3.0.9 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Premio Chaty plugin <= 3.0.9 versions

    Premio Chaty
  • High 7.1
    CVE-2023-32597

    WordPress Video Gallery Plugin <= 1.0.10 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution Video Gallery plugin <= 1.0.10 versions.

    I Thirteen Web Solution Video Gallery
  • Medium 6.5
    CVE-2023-32746

    WordPress WooCommerce Brands Plugin <= 1.6.45 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WooCommerce WooCommerce Brands plugin <= 1.6.45 versions.

    woocommerce WooCommerce Brands Web / CMS
  • Medium 6.5
    CVE-2023-32793

    WordPress WooCommerce Pre-Orders Plugin <= 2.0.0 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WooCommerce WooCommerce Pre-Orders plugin <= 2.0.0 versions.

    woocommerce WooCommerce Pre-Orders Web / CMS
  • High 7.1
    CVE-2023-32802

    WordPress WooCommerce Pre-Orders Plugin <= 1.9.0 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce WooCommerce Pre-Orders plugin <= 1.9.0 versions.

    woocommerce WooCommerce Pre-Orders Web / CMS
  • Medium 4.3
    CVE-2023-4600

    The AffiliateWP for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on t…

    AffiliateWP AffiliateWP
  • High 7.1
    CVE-2023-32801

    WordPress WooCommerce Composite Products Plugin <= 8.7.5 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce Composite Products plugin <= 8.7.5 versions.

    woocommerce Composite Products
  • High 7.1
    CVE-2023-32742

    WordPress WP SMS Plugin <= 6.1.4 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in VeronaLabs WP SMS plugin <= 6.1.4 versions.

    VeronaLabs WP SMS
  • Medium 5.8
    CVE-2023-32740

    WordPress Custom 404 Pro Plugin <= 3.8.1 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Kunal Nagar Custom 404 Pro plugin <= 3.8.1 versions.

    Kunal Nagar Custom 404 Pro
  • High 7.2
    CVE-2023-3136

    MailArchiver <= 2.10.1 - Unauthenticated Stored Cross-Site Scripting via Email Subject

    The MailArchiver plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 2.10.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers t…

    Pierre Lannoy MailArchiver Web / CMS
  • Medium 4.3
    CVE-2023-4522

    Improper Validation of Specified Type of Input in GitLab

    An issue has been discovered in GitLab affecting all versions before 16.2.0. Committing directories containing LF character results in 500 errors when viewing the commit.

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Critical 9.8
    CVE-2023-4596 Public exploit Scanner template EPSS 14%

    Forminator <= 1.24.6 - Unauthenticated Arbitrary File Upload

    The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to file type validation occurring after a file has been uploaded to the server in the upload_post_image() function in versions up to, and including, 1.24.6. This makes it possible…

    WPMU DEV Forminator Forms – Contact Form, Payment Form & Custom Form Builder Web / CMS
  • Medium 6.4
    CVE-2023-4599

    Email Encoder <= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    The Email Encoder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'eeb_mailto' shortcode in versions up to, and including, 2.1.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it po…

    Online Optimisation Email Encoder – Protect Email Addresses and Phone Numbers Web / CMS
  • Medium 6.4
    CVE-2023-4597

    Slimstat Analytics <= 5.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    The Slimstat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slimstat' shortcode in versions up to, and including, 5.0.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it…

    VeronaLabs Slimstat Analytics Web / CMS
  • High 7.8
    CVE-2023-39137

    Filename spoofing in archive

    An issue in Archive v3.3.7 allows attackers to spoof zip filenames which can lead to inconsistent filename parsing.

    archive Pub
  • High 7.8
    CVE-2023-39138

    Path traversal in ZIPFoundation

    An issue in ZIPFoundation v0.9.16 allows attackers to execute a path traversal via extracting a crafted zip file.

    github.com/weichsel/ZIPFoundation SwiftURL
  • High 7.8
    CVE-2023-39139

    Path traversal in Archive

    An issue in Archive v3.3.7 allows attackers to execute a path traversal via extracting a crafted zip file.

    archive Pub
  • Unscored —
    CVE-2023-39136

    An unhandled edge case in the component _sanitizedPath of ZipArchive v2.5.4 allows attackers to cause a Denial of Servi…

  • High 7.8
    CVE-2023-39135

    Path traversal in Zip Swift

    An issue in Zip Swift v2.1.2 allows attackers to execute a path traversal attack via a crafted zip entry.

    github.com/marmelroy/Zip SwiftURL
  • Medium 5.4
    CVE-2023-38970

    Badaso vulnerable to cross-site scripting

    Cross Site Scripting vulnerabiltiy in Badaso v.0.0.1 thru v.2.9.7 allows a remote attacker to execute arbitrary code via a crafted payload to the Name of member parameter in the add new member function.

    uasoft-indonesia/badaso Packagist
  • Unscored —
    CVE-2023-31714 Public exploit

    Chitor-CMS before v1.1.2 was discovered to contain multiple SQL injection vulnerabilities.

  • Unscored —
    CVE-2023-40848

    Tenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin is vulnerable to Buffer Overflow via the function "sub_7D858."

  • Unscored —
    CVE-2023-40839

    Tenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin function 'sub_ADF3C' contains a command execution vulnerability. In …

  • Unscored —
    CVE-2023-40847

    Tenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin is vulnerable to Buffer Overflow via the function "initIpAddrInfo." …

  • Unscored —
    CVE-2023-40841

    Tenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin is vulnerable to Buffer Overflow via function "add_white_node,"